fedipod-server 0.29.0 → 0.30.0

package/lib/device/account.mjs

@@ -1,87 +0,0 @@
-// account.mjs — create a brand-new account + pod on a CSS server (v7 account
-// API), the `setup --new-account` path. Public-server sibling of
-// data-kitchen's seed-account.cjs, but simpler: the pod.create control makes
-// the pod AND its WebID in one step — no ownership challenge, because the
-// server authors the WebID itself.
-//
-// Flow: POST .account/account/ (or login when the email already exists) →
-// password.create → account.pod {name} → { pod, webId }.
-
-async function jfetch(url, { method = 'GET', body, cookie } = {}) {
-  const headers = { accept: 'application/json' };
-  if (body !== undefined) headers['content-type'] = 'application/json';
-  if (cookie) headers.cookie = cookie;
-  const res = await fetch(url, { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
-  let json = null;
-  try { json = await res.json(); } catch { /* non-JSON */ }
-  return { status: res.status, json };
-}
-
-export async function createAccountWithPod({ issuer, email, password, podName }) {
-  const origin = issuer.replace(/\/+$/, '');
-  const accountRoot = `${origin}/.account/`;
-
-  // Authenticate: log in when the email is already registered (idempotent
-  // re-runs), otherwise create the account and set its password.
-  let cookie;
-  const login = await jfetch(`${accountRoot}login/password/`, { method: 'POST', body: { email, password } });
-  if (login.status < 400 && login.json?.authorization) {
-    cookie = `css-account=${login.json.authorization}`;
-  } else {
-    const create = await jfetch(`${accountRoot}account/`, { method: 'POST' });
-    if (!create.json?.authorization) {
-      throw new Error(`account create failed (HTTP ${create.status}): ${create.json?.message || 'is this a CSS server with signup enabled?'}`);
-    }
-    cookie = `css-account=${create.json.authorization}`;
-    const pwCreate = (await jfetch(accountRoot, { cookie })).json?.controls?.password?.create;
-    if (!pwCreate) throw new Error('password.create control missing — not a CSS v7 account API');
-    const pw = await jfetch(pwCreate, { method: 'POST', cookie, body: { email, password } });
-    if (pw.status >= 400) throw new Error(`password create failed (HTTP ${pw.status}): ${pw.json?.message || ''}`);
-  }
-
-  // Create the pod (server picks root-path or subdomain layout). When the
-  // name is already taken BY THIS ACCOUNT — a setup re-run, or a pod made
-  // earlier by hand — reuse it; taken by someone else stays a hard error.
-  const controls = (await jfetch(accountRoot, { cookie })).json?.controls;
-  const podCreate = controls?.account?.pod;
-  if (!podCreate) throw new Error('pod create control missing — not a CSS v7 account API');
-  // Scheme-agnostic on purpose: matching `https://name.` missed every pod on an
-  // http server, so a re-run after a crashed setup always tried to create again
-  // and died on "already registered to this account".
-  const findOwn = async () => {
-    const pods = (await jfetch(podCreate, { cookie })).json?.pods || {};
-    return Object.entries(pods).find(([url]) => {
-      try {
-        const u = new URL(url);
-        return u.hostname === podName || u.hostname.startsWith(`${podName}.`)
-          || u.pathname.split('/').filter(Boolean).includes(podName);
-      } catch { return false; }
-    }) || null;
-  };
-  // One pod per account, refused BEFORE anything is created. A second pod gives
-  // the account a second WebID, and a credential can only be bound to one of
-  // them — so the second actor authenticates and then 403s every write to its
-  // own pod. Reusing a pod of the same name is still fine: that is a re-run of
-  // a setup, not a second identity.
-  const owned = Object.keys((await jfetch(podCreate, { cookie })).json?.pods || {});
-  if (owned.length && !await findOwn()) {
-    throw new Error(`${email} already has a pod on ${new URL(origin).host}: ${owned[0]} — `
-      + 'one account, one pod. A second actor needs its own account and email. '
-      + 'Nothing was created.');
-  }
-  const made = await jfetch(podCreate, { method: 'POST', cookie, body: { name: podName } });
-  let pod = made.json?.pod || made.json?.podBaseUrl || null;
-  let webId = made.json?.webId || null;
-  if (made.status >= 400 || !pod) {
-    const own = await findOwn();
-    if (own) {
-      pod = own[0];
-      webId = webId || own[1]?.webId || null;
-    } else if (made.status >= 400) {
-      throw new Error(`pod create failed (HTTP ${made.status}): ${made.json?.message || `is the name "${podName}" taken by another account?`}`);
-    }
-  }
-  if (!pod) throw new Error('pod created but its URL was not reported — check the account dashboard');
-  pod = pod.endsWith('/') ? pod : pod + '/';
-  return { pod, webId: webId || new URL('profile/card#me', pod).href };
-}

package/lib/device/admin/index.mjs

@@ -1,13 +0,0 @@
-// admin.mjs — loopback HTTP front: admin API + Mastodon client-API facade +
-// the bundled Phanpy UI served same-origin (no CORS, no mixed content — the
-// role data-kitchen's router plays for the in-app pane). Loopback-bound; the
-// gate (vendor/gate.cjs) engages only when a token is configured, exactly
-// its standalone behavior.
-//
-// The surface is surface.mjs, its routes are the modules under routes/, the
-// static serving is static.mjs, the listener is server.mjs. This file is the
-// door the rest of the agent imports through.
-
-export { buildAdminSurface } from './surface.mjs';
-export { startAdmin } from './server.mjs';
-export { namedOrigin, secureOrigin, wsOrigins } from './origins.mjs';

package/lib/device/admin/origins.mjs

@@ -1,35 +0,0 @@
-// origins.mjs — the addresses an identity answers on, as a browser must be
-// sent to them.
-
-import { allowedAuthorities, hostLabel } from '../../shared/guard.mjs';
-
-// The origin a browser should be sent to for an identity. A browser keys
-// storage per ORIGIN, so linking every identity at localhost:<port> files them
-// all in one bucket — which is how a client ends up holding one actor's login
-// and showing it on another's page. Named whenever the handle is a legal host
-// label; bare loopback when it is not, because a mangled name would be an
-// origin the other agent's own guard refuses.
-export function namedOrigin(handle, port) {
-  const label = hostLabel(handle);
-  return `http://${label ? label + '.' : ''}localhost:${port}`;
-}
-
-// The https origin for an identity, on the one port it was given.
-// This is the advertised default — what gets printed, opened and linked; the
-// http listener stays served beside it for anything that needs cleartext.
-export function secureOrigin(handle, httpsPort) {
-  const label = hostLabel(handle);
-  return `https://${label ? label + '.' : ''}localhost:${httpsPort}`;
-}
-
-export function wsOrigins(port, labels = []) {
-  const out = new Set();
-  for (const a of allowedAuthorities(port, labels)) {
-    // No IPv6 at all. Bare `::1` cannot carry a port, and Chrome rejects the
-    // bracketed form inside a CSP source expression — one invalid source makes
-    // it drop the whole directive, which is worse than not listing the socket.
-    if (a.startsWith('::') || a.startsWith('[')) continue;
-    out.add(`wss://${/:\d+$/.test(a) ? a : `${a}:${port}`}`);
-  }
-  return [...out];
-}

package/lib/device/admin/routes/connections.mjs

@@ -1,144 +0,0 @@
-// connections.mjs — the accounts held elsewhere: a Bluesky account and
-// accounts on other fediverse servers, connected, adjusted, disconnected;
-// and the page the other server's sign-in comes back to.
-
-
-
-// The page the other server's redirect lands on. Self-contained on purpose:
-// the browser arrives here from somewhere else, and nothing may load from
-// that somewhere.
-function callbackPage(ok, msg) {
-  const esc = (s) => String(s).replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
-  const head = ok ? 'Account connected' : 'Not connected';
-  return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${head}</title>
-<style>
-  :root { color-scheme: light dark; }
-  body { font: 16px/1.7 system-ui, -apple-system, sans-serif; margin: 0;
-         padding: 2.5rem 2rem; background: #ffffff; color: #1a1a1a; }
-  main { max-width: 32rem; margin: 0 auto; }
-  h1 { font-size: 1.375rem; font-weight: 500; margin: 0 0 1rem; }
-  p { margin: 0 0 1rem; }
-  @media (prefers-color-scheme: dark) {
-    body { background: #16161a; color: #ececf0; }
-  }
-</style></head>
-<body><main>
-<h1>${head}</h1>
-<p>${esc(msg)}</p>
-<p>You can close this tab and go back to FediPod.</p>
-</main></body></html>
-`;
-}
-
-export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-unused-vars
-  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
-  const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
-
-  if (req.method === 'GET' && p === '/fediacct') {
-    return json(res, 200, { accounts: agent.fediaccts?.status() || [] });
-  }
-  // Where the other server sends the browser back. A GET, so it gets none
-  // of the POST branch's local-only protection for free and asks for its
-  // own — a code arriving from anywhere else is not the owner's.
-  if (req.method === 'GET' && p === '/fediacct/callback') {
-    if (!embedded && !allowed.isLocalRequest(req)) {
-      return json(res, 403, { error: 'connecting an account is available on this machine only' });
-    }
-    const q = new URL(req.url, 'https://x.invalid').searchParams;
-    const done = (ok, msg) => {
-      res.writeHead(ok ? 200 : 400, { 'content-type': 'text/html; charset=utf-8' });
-      res.end(callbackPage(ok, msg));
-      return true;
-    };
-    if (q.get('error')) return done(false, q.get('error_description') || q.get('error'));
-    if (!q.get('code') || !q.get('state')) return done(false, 'that sign-in came back incomplete');
-    try {
-      const row = await agent.fediaccts.complete({ state: q.get('state'), code: q.get('code') });
-      const cfg = agent.store.getConfig();
-      agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
-      await agent.store.flush();
-      agent.restartAccts?.();
-      return done(true, `${row.handle} is connected.`);
-    } catch (e) { return done(false, e.message); }
-  }
-
-  return false;
-}
-
-export async function post(p, body, ctx, req, res) {   // eslint-disable-line no-unused-vars
-  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
-  const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
-  switch (p) {
-    case '/atproto/connect': {
-      // The one endpoint that ever sees the app password; loopback-only.
-      if (!body.identifier || !body.appPassword) {
-        return json(res, 400, { error: 'identifier and appPassword required' });
-      }
-      const conn = await agent.atproto.connect({
-        service: body.service, identifier: body.identifier, appPassword: body.appPassword,
-      });
-      const cfg = agent.store.getConfig();
-      agent.store.setConfig({
-        ...cfg,
-        atproto: { ...conn, crossPost: cfg.atproto?.crossPost ?? true },
-      });
-      await agent.store.flush();
-      agent.startBsky?.();
-      return json(res, 200, { ok: true, ...agent.atproto.status() });
-    }
-    case '/atproto/disconnect': {
-      agent.stopBsky?.();
-      await agent.atproto.disconnect();
-      const { atproto, ...rest } = agent.store.getConfig();
-      agent.store.setConfig(rest);
-      await agent.store.flush();
-      return json(res, 200, { ok: true });
-    }
-    case '/atproto': {
-      // Non-secret settings only — today that is the cross-post toggle.
-      const cfg = agent.store.getConfig();
-      if (!cfg.atproto) return json(res, 400, { error: 'no bluesky account connected' });
-      agent.store.setConfig({
-        ...cfg, atproto: { ...cfg.atproto, crossPost: !!body.crossPost },
-      });
-      await agent.store.flush();
-      return json(res, 200, { ok: true, atproto: { ...cfg.atproto, crossPost: !!body.crossPost } });
-    }
-    case '/fediacct/connect': {
-      // Starts the sign-in at the other server. Loopback-only, and the
-      // redirect returns to the origin the owner is actually using, not a
-      // guess — a client reaches this agent by several names.
-      if (!body.host) return json(res, 400, { error: 'the address of the server is required' });
-      try {
-        const { url } = await agent.fediaccts.begin({
-          host: body.host, redirectUri: `https://${req.headers.host}/fediacct/callback`,
-        });
-        return json(res, 200, { ok: true, authorize: url });
-      } catch (e) { return json(res, 400, { error: e.message }); }
-    }
-    case '/fediacct/disconnect': {
-      if (!body.id) return json(res, 400, { error: 'id required' });
-      if (!await agent.fediaccts.remove(body.id)) return json(res, 404, { error: 'no such account' });
-      const cfg = agent.store.getConfig();
-      agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
-      await agent.store.flush();
-      agent.restartAccts?.();
-      return json(res, 200, { ok: true });
-    }
-    case '/fediacct': {
-      // Non-secret settings only — today that is whether it is polled.
-      if (!body.id) return json(res, 400, { error: 'id required' });
-      const row = agent.fediaccts.setEnabled(body.id, !!body.enabled);
-      if (!row) return json(res, 404, { error: 'no such account' });
-      const cfg = agent.store.getConfig();
-      agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
-      await agent.store.flush();
-      agent.restartAccts?.();
-      return json(res, 200, { ok: true, account: row });
-    }
-    default: return false;
-  }
-}

package/lib/device/admin/routes/gateway.mjs

@@ -1,199 +0,0 @@
-// gateway.mjs — the inbox gateway lifecycle: configure, mode, check, attach
-// through a front, forget.
-
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawn } from 'node:child_process';
-
-export async function post(p, body, ctx, req, res) {   // eslint-disable-line no-unused-vars
-  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
-  const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
-  switch (p) {
-    // The inbox gateway lifecycle (opt-in). `configure` points at a
-    // deployed gateway (and reveals the HMAC secret once, to paste into
-    // its env); `mode` walks off→shadow→trust→locked and back, each step
-    // reversible; `forget` clears it and restores the pod inbox.
-    case '/gateway': {
-      const cfg = { ...agent.store.getConfig() };
-      const g = { ...(cfg.gateway || {}) };
-      const inboxUrl = agent.publisher?.urls?.inbox;
-      // Availability is a read: answered before the lease takeover below,
-      // which every real gateway change does want.
-      if (body.action === 'check') {
-        const front = String(body.front || '').replace(/\/+$/, '');
-        try { new URL(front); } catch { return json(res, 400, { error: 'front must be a gateway origin URL' }); }
-        const chk = await fetch(`${front}/api/handle?handle=${encodeURIComponent(String(body.handle || '').toLowerCase())}`,
-          { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
-        if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
-        return json(res, 200, { available: !!chk.available, reason: chk.reason || null });
-      }
-      await agent.requestTakeover?.();
-      const persist = async () => {
-        cfg.gateway = g; agent.store.setConfig(cfg);
-        if (agent.publisher) agent.publisher.config.gateway = g;
-        await agent.store.flush();
-      };
-      // Fronting renames the actor's ids; the signing key is the same
-      // identity's and moves with it, wherever the key record lives.
-      const restampKeys = async (actorId) => {
-        try {
-          const kp = path.join(agent.home, 'keys.json');
-          const rec = JSON.parse(fs.readFileSync(kp, 'utf8'));
-          if (rec.mintedFor) { rec.mintedFor = actorId; fs.writeFileSync(kp, JSON.stringify(rec)); return; }
-        } catch { /* not local — try pod state */ }
-        const podRec = agent.store.read('keys.json', null);
-        if (podRec?.mintedFor) { podRec.mintedFor = actorId; agent.store.write('keys.json', podRec); await agent.store.flush(); }
-      };
-      const podActorId = () => {
-        const base = cfg.remotePod.endsWith('/') ? cfg.remotePod : `${cfg.remotePod}/`;
-        const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'fedipod/';
-        return `${base}${root}ap/actor`;
-      };
-      // The reply first, the restart a beat later — same shape as /update.
-      const selfRestart = (why) => setTimeout(() => {
-        log(why);
-        if (process.env.INVOCATION_ID) { process.exit(1); return; }   // systemd: Restart=on-failure respawns
-        const child = spawn(process.execPath, process.argv.slice(1),
-          { detached: true, stdio: 'ignore', env: process.env });
-        child.unref();
-        setTimeout(() => process.exit(0), 300);
-      }, 200);
-      if (body.action === 'configure') {
-        if (!/^https:\/\/\S+$/.test(String(body.url || ''))) return json(res, 400, { error: 'gateway url must be https' });
-        if (!/^https?:\/\/\S+$/.test(String(body.webId || ''))) return json(res, 400, { error: 'gateway webId must be a URL' });
-        g.url = String(body.url); g.webId = String(body.webId);
-        g.hmacSecret = g.hmacSecret || crypto.randomBytes(32).toString('base64');
-        g.mode = g.mode || 'off';
-        // The fronted actor URL, for a multi-user front that gives this
-        // identity a @name@front handle: the agent then publishes and signs
-        // under it. Optional; setting it on a published identity renames
-        // every id (a Move), so it belongs at setup or a fresh identity.
-        if ('frontActor' in body) {
-          const fa = String(body.frontActor || '');
-          if (fa && !/^https:\/\/\S+\/ap\/actor$/.test(fa)) {
-            return json(res, 400, { error: 'frontActor must be an https …/ap/actor URL' });
-          }
-          g.frontActor = fa || undefined;
-        }
-        await persist();
-        // The one time the secret is returned: the operator pastes it into
-        // the gateway's deploy env. /gateway GET never reveals it again.
-        return json(res, 200, { ok: true, mode: g.mode, url: g.url, webId: g.webId, hmacSecret: g.hmacSecret });
-      }
-      if (body.action === 'mode') {
-        const target = body.mode;
-        if (!['off', 'shadow', 'trust', 'locked'].includes(target)) {
-          return json(res, 400, { error: 'mode must be off, shadow, trust or locked' });
-        }
-        if (target !== 'off' && !g.url) return json(res, 400, { error: 'point at a gateway first (action: configure)' });
-        // Locking needs the door's own WebID to name in the ACL. Without it
-        // the mode used to persist and the ACL be written for an undefined
-        // agent, leaving config and pod disagreeing about who may write.
-        if (target === 'locked' && !g.webId) {
-          return json(res, 400, {
-            error: 'locked needs the gateway\'s WebID — set it with action: configure, webId: <door-webid>',
-          });
-        }
-        const prev = g.mode || 'off';
-        // The ACL first: a lock that fails must not leave the mode recorded
-        // as locked while the pod still accepts anyone's writes.
-        if (target === 'locked') await agent.publisher?.lockInboxToGateway(g.webId);
-        else if (prev === 'locked' && inboxUrl) await agent.remote.setAcl(inboxUrl, ['Append']);
-        g.mode = target;
-        await persist();
-        // Advertisement flips only when crossing the off boundary (the actor
-        // doc's inbox changes → publishProfile republishes, digest-gated).
-        if ((prev === 'off') !== (target === 'off')) await agent.publisher?.publishProfile();
-        else if (target !== 'off') await agent.publisher?.publishGatewayPolicy().catch(() => {});
-        return json(res, 200, { ok: true, mode: g.mode });
-      }
-      // Attach through a multi-user front (fedipod.net and kin): the agent
-      // proves the pod with its own credential — no browser, no password —
-      // and the front answers with the door and the receipt secret.
-      if (body.action === 'attach') {
-        const front = String(body.front || '').replace(/\/+$/, '');
-        let fu;
-        try { fu = new URL(front); } catch { return json(res, 400, { error: 'front must be the gateway origin, like https://fedipod.net' }); }
-        if (fu.protocol !== 'https:' && !/^(localhost|127\.0\.0\.1)$|\.localhost$/.test(fu.hostname)) {
-          return json(res, 400, { error: 'front must be https' });
-        }
-        if (agent.embedded) {
-          return json(res, 400, { error: 'this identity runs inside its pod server and has no portable credential — attach from a standalone agent' });
-        }
-        const named = !!String(body.handle || '').trim();
-        let handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
-        if (!handle) return json(res, 400, { error: 'a name at the gateway is required' });
-        const fronted = body.fronted === true;
-        // Availability first, for a clean answer before anything is created.
-        const avail = async (h) => fetch(`${front}/api/handle?handle=${encodeURIComponent(h)}`,
-          { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
-        let chk = await avail(handle);
-        if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
-        // An unnamed door name is plumbing nobody reads: walk to a free
-        // variant instead of failing over a label the user never chose.
-        if (!chk.available && !named) {
-          for (let i = 2; i <= 9 && !chk.available; i++) {
-            const cand = `${handle}${i}`;
-            const c = await avail(cand);
-            if (c?.available) { handle = cand; chk = c; }
-          }
-        }
-        if (!chk.available) return json(res, 409, { error: chk.reason || `the name ${handle} is taken at ${front}` });
-        const frontActor = `${front}/u/${handle}/ap/actor`;
-        if (g.frontActor && (!fronted || g.frontActor !== frontActor)) {
-          return json(res, 400, { error: `this identity already fronts through ${g.frontActor} — changing a published front renames every id; detach first if you mean it` });
-        }
-        const attach = await agent.remote.session.fetch(`${front}/api/attach`, {
-          method: 'POST', headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ handle, podHome: agent.urls.home, kind: cfg.kind || 'person', fronted }),
-        }).catch(() => null);
-        if (!attach) return json(res, 502, { error: `${front} did not answer the attach` });
-        const d = await attach.json().catch(() => ({}));
-        if (attach.status !== 201) {
-          return json(res, attach.status >= 400 && attach.status < 500 ? attach.status : 502,
-            { error: d.error || `attach failed (HTTP ${attach.status})` });
-        }
-        g.url = String(d.doorInbox || `${front}/u/${handle}/ap/inbox/`);
-        if (d.hmacSecret) g.hmacSecret = String(d.hmacSecret);
-        if (fronted) g.frontActor = String(d.frontActor || frontActor);
-        if (!g.mode || g.mode === 'off') g.mode = 'shadow';
-        await persist();
-        // Inbox-only applies live: the actor republishes advertising the
-        // door. A front carries new ids, which are wired at startup — so a
-        // fronted attach restarts this agent itself, the reply going out
-        // first so it is not taken down with the process.
-        if (!fronted) {
-          await agent.publisher?.publishProfile();
-          await agent.publisher?.publishGatewayPolicy?.().catch(() => {});
-          return json(res, 200, { ok: true, mode: g.mode, url: g.url });
-        }
-        await restampKeys(g.frontActor);
-        json(res, 200, { ok: true, mode: g.mode, url: g.url,
-          frontActor: g.frontActor, address: d.address || null, restarting: true });
-        selfRestart('restarting to publish under the front');
-        return true;
-      }
-      if (body.action === 'forget') {
-        const wasLocked = g.mode === 'locked';
-        const wasFronted = !!g.frontActor;
-        delete cfg.gateway; agent.store.setConfig(cfg);
-        if (agent.publisher) agent.publisher.config.gateway = undefined;
-        await agent.store.flush();
-        if (wasLocked && inboxUrl) await agent.remote.setAcl(inboxUrl, ['Append']).catch(() => {});
-        if (wasFronted) {
-          // Going home renames every id back to the pod: key and process
-          // follow, the same way attach came.
-          await restampKeys(podActorId());
-          json(res, 200, { ok: true, mode: 'off', forgotten: true, restarting: true });
-          selfRestart('restarting under the pod\'s own ids');
-          return true;
-        }
-        await agent.publisher?.publishProfile();   // re-advertise the pod inbox
-        return json(res, 200, { ok: true, mode: 'off', forgotten: true });
-      }
-      return json(res, 400, { error: 'action must be configure, mode, check, attach or forget' });
-    }
-    default: return false;
-  }
-}